Loading story…
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, a critical improper neutralization vulnerability rated 9.9 on CVSS v3.1. Under certain conditions, an authenticated user with Duo Agent Platform access could submit a specially crafted flow configuration, escape the prompt template sandbox, and execute arbitrary commands on the AI Gateway. GitLab conducted targeted customer outreach before announcing the patches; the supplied notices do not report exploitation.
GitLab strongly recommends that affected Self-Hosted AI Gateway installations upgrade immediately to the applicable patched version. GitLab-hosted AI Gateways have already been patched, so GitLab.com, GitLab Dedicated, and GitLab Self-Managed customers using those hosted gateways need no action. The Canadian Centre for Cyber Security reinforced the update guidance in advisory AV26-994, identifying affected releases preceding the three fixed versions and urging administrators to review GitLab’s guidance and apply necessary updates.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Guyana National CIRT issued advisory ADV2026_647, identifying GitLab AI Gateway versions preceding 19.2.4, 19.3.2, and 19.4.1 in their respective release lines as affected. It recommended that users and administrators review GitLab's guidance and apply applicable updates.
CISA added an assessment to the CVE-2026-90970 record listing exploitation as "none," rather than public proof of concept or active exploitation. GitLab's advisory did not state whether the vulnerability had been exploited.
The Canadian Centre for Cyber Security issued advisory AV26-994 concerning the GitLab AI Gateway vulnerability and linked to GitLab's critical patch release. It encouraged users and administrators to review the guidance and apply necessary updates.
GitLab patched CVE-2026-1868, a CVSS 9.9 AI Gateway vulnerability that could let an authenticated user cause denial of service or execute code through a specially crafted flow definition. Like CVE-2026-90970, it was classified as a CWE-1336 template-engine weakness.
CSIRT Italia/ACN issued an advisory warning that a critical GitLab AI Gateway vulnerability could allow an authenticated attacker to execute arbitrary code. It recommended updating vulnerable installations according to GitLab's security bulletin.
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, rated critical with a CVSS v3.1 score of 9.9, and urged affected Self-Hosted customers to upgrade immediately. Under certain conditions, an authenticated user with Duo Agent Platform access could use a crafted flow configuration to escape the prompt template sandbox and execute arbitrary commands on the gateway.
Before publishing its release announcement, GitLab conducted targeted outreach to Self-Hosted AI Gateway customers with upgrade guidance.
GitLab deployed the security fix to GitLab-hosted AI Gateways before announcing the release. GitLab.com, GitLab Dedicated, and GitLab Self-Managed customers using those hosted gateways did not need to take action.
Researcher invisiblemeerkat responsibly disclosed CVE-2026-90970, an improper neutralization vulnerability in the GitLab AI Gateway custom flow prompt template. GitLab credited the researcher in its patch announcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
17 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesocradar.io
Open sourcemkd-cirt.mk
Open sourceacn.gov.it
Open sourcethehackernews.com
Open sourcedocs.gitlab.com
Open sourcedocs.gitlab.com
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab remediated **CVE-2026-1868**, a critical flaw in the *Duo Workflow Service* component of **GitLab AI Gateway** caused by improper neutralization during template expansion of user-supplied data. By submitting crafted **Duo Agent Platform Flow definitions**, an attacker could trigger **denial of service** or potentially achieve **remote code execution (RCE)** on the AI Gateway, turning the AI workflow feature into an execution path on the underlying gateway service. The issue impacts self-hosted GitLab AI Gateway deployments across multiple version tracks, including versions starting at **18.1.6**, **18.2.6**, and **18.3.1** up to vulnerable releases such as **18.6.1**, **18.7.0**, and **18.8.0**. GitLab released fixes in **18.6.2**, **18.7.1**, and **18.8.1**; exploitation requires **authenticated access** to the GitLab instance (e.g., a compromised developer account or malicious insider), and GitLab reported the issue was discovered internally (by a GitLab team member, per reporting).
Jun 29, 2026
GitLab released Community Edition and Enterprise Edition versions **19.2.8, 19.3.4, and 19.4.2** to address 24 security issues, including **CVE-2026-97229**, a critical vulnerability rated CVSS 10.0. The flaw could allow an unauthenticated attacker to execute arbitrary code through a specially crafted regular expression in CI/CD configuration. Reports describe an integer overflow and insufficient validation in the regular expression compiler, but GitLab has not disclosed a complete attack sequence or exact exploitation conditions. The release notice does not report real-world exploitation. The updates also fix five high-severity vulnerabilities and weaknesses involving cross-site scripting, unauthorized pipeline execution, cache poisoning, AI prompt injection, sensitive-data exposure, and authorization bypasses. GitLab recommends **immediately upgrading affected self-managed installations**, with internet-facing deployments a priority; GitLab.com is already patched, and GitLab Dedicated customers need no action. Administrators should account for database migrations that cause downtime during single-node upgrades, while properly executed multi-node upgrades can avoid downtime. After patching, security teams should review logs and CI/CD configuration changes for suspicious activity and investigate connected systems if compromise is suspected. Two release caveats warrant attention: version 19.3.4 has a known merge request page bug when the Ona integration is enabled, and the advisory inconsistently lists all 19.3 versions as affected by CVE-2026-84284 despite naming 19.3.4 as a security patch release; administrators should seek clarification on that separate flaw's remediation status.
Oct 14, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026